The FTC settled with Ascension Data & Analytics, LLC for violating the Gramm-Leach-Bliley Act's Safeguards Rule by failing to ensure its vendor properly protected consumer data. The company must strengthen its security safeguards and increase oversight of vendors. No monetary penalty was imposed.
The company is required to implement and maintain a comprehensive information security program, ensure third-party vendors have adequate safeguards, and increase oversight of vendors.
In-house legal teams should review all vendor and data processing agreements, particularly those involving financial or consumer data. Focus on clauses addressing data security standards, third-party vendor oversight, compliance with the Gramm-Leach-Bliley Act (GLBA) Safeguards Rule, encryption requirements, access controls, regular risk assessments, audit rights, and breach notification procedures. Changes may be needed to mandate that vendors implement specific security measures (e.g., encryption, password protection), require annual security audits or certifications of GLBA compliance, include indemnification for data breaches, and grant termination rights for non-compliance with security obligations.
Entity
Ascension Data & Analytics, LLC
Also known as: Ascension Data & Analytics
Industry
Financial ServicesOfficial Press Release
https://www.ftc.gov/news-events/news/press-releases/2021/12/ftc-finalizes-order-mortgage-analytics-firm-requiring-it-strengthen-security-safeguards-increase
mortgage analytics company settles ftc allegations it failed
https://www.ftc.gov/news-events/press-releases/2020/12/mortgage-analytics-company-settles-ftc-allegations-it-failed
1923126ascensionslaughterdissent
https://www.ftc.gov/system/files/documents/public_statements/1599131/1923126ascensionslaughterdissent.pdf
https://www.ftc.gov/news-events/news/press-releases/
Federal Trade Commission Enforcement Page
https://www.ftc.gov/enforcement
Ascension Data & Analytics, LLC, a mortgage analytics company, settled FTC allegations that it violated the Gramm-Leach-Bliley Act's Safeguards Rule by failing to ensure its vendor adequately protected consumer data. The vendor stored sensitive mortgage information in plain text on a cloud server, leading to unauthorized access. Ascension must implement a data security program, undergo biennial assessments, and report future breaches.
The FTC referred a complaint against REPS & Company Inc. and company executives, alleging they bypassed ticket-issuer security controls and purchasing limits to acquire millions of tickets for resale. The complaint was filed by the Department of Justice, and the case will be decided by the court; the press release does not report a penalty or other remedy imposed.
The FTC sued Digital Forensics Corporation LLC and affiliated defendants, alleging they misled sextortion victims with promises of investigative and monitoring services that often were not provided, and used fake positive reviews. A federal court granted the FTC’s request to temporarily halt the defendants’ activities; the complaint remains for the court to decide.
The FTC alleged that Greenway Auto Group advertised vehicle prices thousands of dollars below the amounts consumers actually paid and used mailers falsely suggesting recipients had won cash prizes. Greenway agreed to an order requiring transparent pricing and prohibiting deceptive prize mailers and other misrepresentations; the press release does not state a monetary penalty.
The FTC sent warning letters to 24 large healthcare services companies, cautioning that incomplete, inaccurate, or untimely pricing information for scheduled medical care may be unfair or deceptive. The letters urge recipients to review their price-disclosure practices and take corrective action; they announce no fine or formal order.
$1.9M
The FTC alleged that Premier Franchising Group LLC and Franchise Fastlane LLC made deceptive and unsubstantiated claims about the Premier Martial Arts franchise opportunity and violated the Franchise Rule. The proposed settlements require the companies to pay a combined $1.85 million to compensate franchisees, prohibit certain misrepresentations, and require Franchise Rule compliance; certain franchisees may also cancel their agreements without penalty.